Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Specified purpose

The purpose named in the notice. Consent covers only the data necessary for it under section 6(1), and once the purpose is no longer served, section 8(7) requires erasure unless a law requires retention. Both duties commence on 13 May 2027, a date computed from the notification, so treat it as interpretation until officially confirmed. The definition in section 2 is in force.

Official requirement · verbatim

“specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder

Read section 2 of the Act, where this term is defined →Rule 3 of the DPDP Rules 2025 →Rule 8 of the DPDP Rules 2025 →

What the definition covers

Plain English

The definition ties the purpose to the notice. Section 5(1) requires every request made to a Data Principal under section 6 for consent to be accompanied or preceded by a notice given by the Data Fiduciary, informing her of the personal data and the purpose for which it is proposed to be processed, together with the other items section 5(1) lists, in such manner and as may be prescribed. Rule 3(b) requires the notice to give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, including at the minimum an itemised description of the personal data and the specified purpose or purposes of, and specific description of the goods or services to be provided or uses to be enabled by, the processing. Section 5 and sections 6(1) to 6(8) and 6(10) commence on 13 May 2027 under paragraph (c) of the commencement notification, and Rule 3 on the same date under Rule 1(4); section 6(9) commences on 13 November 2026 under paragraph (b). Both dates are computed, so treat them as interpretation until officially confirmed.

Plain English

The purpose then limits what may be done. Section 6(1) requires consent to signify an agreement to the processing of personal data for the specified purpose and to be limited to such personal data as is necessary for it; its illustration limits consent given to a telemedicine app to the telemedicine service, because the phone contact list is not necessary for that service. Section 7(a) allows processing for the specified purpose for which the Data Principal has voluntarily provided her personal data, where she has not indicated that she does not consent to its use. Section 12(3) requires a Data Fiduciary, on a request for erasure made in the prescribed manner, to erase the personal data unless retention is necessary for the specified purpose or for compliance with any law for the time being in force, and section 15(b) requires a Data Principal not to impersonate another person while providing her personal data for a specified purpose. Sections 6(1), 7, 12 and 15 commence on 13 May 2027 under paragraph (c) of the commencement notification, a computed date, so treat it as interpretation until officially confirmed.

Plain English

The end of the purpose starts erasure. Section 8(7) requires a Data Fiduciary, unless retention is necessary for compliance with any law for the time being in force, to erase personal data upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier, and to cause its Data Processor to erase any personal data made available to it for processing. Section 8(8) deems the purpose no longer served if the Data Principal neither approaches the Data Fiduciary for the performance of the specified purpose nor exercises any of her rights in relation to the processing for the time period prescribed, and section 8(11) treats her as not having approached it in any period during which she has not initiated contact for that performance, in person or by way of communication in electronic or physical form. Rule 8(1) and the Third Schedule prescribe that period for the classes of Data Fiduciaries and corresponding purposes the Schedule lists, again unless retention is necessary for compliance with any law, and Rule 8(2) requires the Data Fiduciary to inform the Data Principal at least 48 hours before the period ends that the data will be erased unless she logs into her user account or otherwise initiates contact for the performance of the specified purpose or exercises her rights in relation to the processing of that data. Sections 8(7), 8(8) and 8(11) commence on 13 May 2027 under paragraph (c) of the commencement notification, and Rule 8 on the same date under Rule 1(4); the date is computed, so treat it as interpretation until officially confirmed.

Interpretation requires judgment

For a Data Fiduciary outside the classes the Third Schedule lists, or a Data Fiduciary in a listed class processing for a purpose outside the corresponding purposes listed for that class, no period has been prescribed, so on the Rules as notified the deeming in section 8(8) does not operate for it and the question is the one in section 8(7), whether it is reasonable to assume that the specified purpose is no longer being served, unless retention is necessary for compliance with any law for the time being in force. A later change of plan does not move the specified purpose, because the definition fixes it as the purpose mentioned in the notice given in accordance with the Act and the Rules; where consent is the basis, a new purpose needs a new request for consent and the notice that goes with it under section 5(1). Sections 5, 8(7) and 8(8) commence on 13 May 2027 under paragraph (c) of the commencement notification, and Rule 8 on the same date under Rule 1(4); the date is computed, so treat it as interpretation until officially confirmed.

Related tool

Privacy Notice Checker

Check whether your notice covers the elements the DPDP sources require.

Open

Related tool

Retention and Erasure Planner

Identify DPDP retention and erasure triggers and the action steps for your context.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(za), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(za), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  4. [4]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  5. [5]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b)(i), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  6. [6]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b)(ii), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  7. [7]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  8. [8]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  9. [9]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  11. [11]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 3, (b), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  12. [12]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  13. [13]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  14. [14]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  15. [15]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(1), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
  16. [16]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 6(1), p. 5. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Phased commencement; it commences in 2 parts: sub section (9) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
  17. [17]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(a), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  18. [18]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 12(3), p. 10. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  19. [19]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 15(b), p. 10. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  20. [20]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 7(a), p. 6. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  21. [21]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  22. [22]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Document status: published; in effect per its own terms
  23. [23]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  24. [24]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(a), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  25. [25]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(a), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  26. [26]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(7)(b), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  27. [27]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(8), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  28. [28]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(11), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  29. [29]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  30. [30]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (2), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  31. [31]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  32. [32]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026
  33. [33]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 8, (1), p. 27. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  34. [34]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(8)(a), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  35. [35]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(8), p. 8. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  36. [36]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(za), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026In force since 13 November 2025
  37. [37]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 5(1), p. 4. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 5 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed